| Titel | DrayTek Vigor2960 Vigor2960 1.5.1.6 (revision 8218) Authenticated set_table JSONData Command Injection |
|---|
| Beschreibung | The jsondata accepted by action=set_table is deeply parsed, and the sectiontype field reaches later UCI/shell command construction. The current PoC confirms command execution on the real device by setting apmd.general.codexpoc=hit.
Affected path(s):
POST /cgi-bin/mainfunction.cgi with action=set_table
Root cause:
The parsed jsondata.sectiontype value is inserted into command construction and reaches system() without shell-safe isolation.
Confirmed impact:
An authenticated attacker can inject arbitrary shell commands through jsondata and execute them with the CGI process privileges on the device. |
|---|
| Quelle | ⚠️ https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0006-authenticated-set-table-command-injection |
|---|
| Benutzer | eqqie (UID 101441) |
|---|
| Einreichung | 19.09.2026 16:45 (vor 1 Monat) |
|---|
| Moderieren | 20.10.2026 07:50 (1 month later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 422665 [DrayTek Vigor2960 1.5.1.6 Revision 8218 CGI Process mainfunction.cgi set_table sectiontype erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|